3

Since yesterday, most of users in our region and as far as I know, many other peoples received a lot of link redirection. most of these redirection are going to adfoc.us website. this redirection happens after going to page (not exactly as you go to page) and new URL have no "Back" button.
I understood that the URLs which didn't visited yet are redirecting to adfoc.us websites so if we visit URL A and see the adfoc.us advertising once, we won't see it again if we go to URL A again.

What is the problem and how can I fix it? I use Windows 7 and Google Chrome browser and tried these:

  • Scanning whole my drive for virus and other bad wares
  • Disabling plug-ins and extensions
  • Clearing DNS cache and other caches
  • Using different DNS servers

Redirection example:
Original URL: http://isthisretina.com/
Redirected URL: http://adfoc.us/serve/?id=25497650908175

I also tried to ping the pages I never visited before like linuxmint.com here are the results:
Linuxmint.com: [213.175.215.218] Packets: Sent = 33, Received = 33, Lost = 0 (0% loss)
comodo.com: [91.199.212.176] Packets: Sent = 33, Received = 33, Lost = 0 (0% loss)

And also note that this redirections are stopped 3 hours ago and I don't know is it only for me or for other users, they stopped to.

19
  • 1
    This happens in Italy too. It is happening on both mobile and desktop chrome browser, as far as I know. I tried this in 2 different networks. I thought it could've been ISP related, but since it is going on abroad, too... I am at a loss
    – Stark
    Nov 25 '14 at 4:44
  • 1
    I have it in Sweden to. It has begun for two days now. I'm only using Mac software/hardwares. I cant understand why this happening. Any sugestions to a fix is very helpful..
    – user393108
    Nov 25 '14 at 4:52
  • Which region/ISP?
    – Journeyman Geek
    Nov 25 '14 at 5:01
  • 1
    Further, I saw that the DNS addresses in the router I was using had been changed (read hacked). The primary address had been set to 94.249.192.82. The secondary address was set to the original primary address (8.8.8.8). The router is a TP-Link ADSL2+ Router. Nov 28 '14 at 23:50
  • 1
    The last redirection before it stopped took me to www.aliexpress.com rather than adfoc.us. Nov 29 '14 at 0:01
1

Google helped me: Some pages in Chrome always redirect to ransom page at http://system-check-fyeltkhn.in

Your router has been hacked and you need to fix your dns and upgrade the firmware

2
  • Nop. It didn't because we use safest methods to protect our network and things like modems. in other hand, It's no only my modems problem as I said, a lot of people have this problem these days. Nov 25 '14 at 7:55
  • Stark, have you installed Google Docs 0.7 on your chrome? Nov 30 '14 at 22:44
0

There are three thing you can do.

Try another browser. If it doesn't work... Try using a different DNS... like a public DNS such as 8.8.8.8 or 8.8.4.4 or using a VPN service with your browser like zenmate (Zenmate is a pluging for chrome)

Are all of the people using the same ISP as yours?

4
  • Redirection happens if there's a server in between altering DNS requests or if the DNS it self is redirecting you. DNS is the server which coverts the URL in to server IP or helps locate the server.
    – Kunwar
    Nov 24 '14 at 21:24
  • No, they don't. I tried google's public dns before and even other browsers but no result. I really have no idea why is going on. Nov 24 '14 at 21:31
  • Okay try using Zenmate... also can you paste a trace route to that website and a screen shot of what you are getting with URL so that I can test things on my end to see if I can help you with this.
    – Kunwar
    Nov 24 '14 at 21:33
  • Ok, I edited the question. Nov 24 '14 at 22:00
0

Check both extension and plug-ins whether any recently installed plug-in is causing the issue.

To delete any extension follow the below path:

Chrome menu icon > More tools > Extensions > delete extensions

To disable unwanted plugins go to chrome -- plugins and disable it.

3
  • As I said, I tried doing this and it's not ONLY my problem. I know a lot of people which have this problem since yesterday or two days ago so I think this problem can not be happened by a single plugin. Nov 24 '14 at 22:01
  • 1
    @AmirrezaNasiri Just because others have that problem as well doesn't mean it's nothing on your local PC. It might be some hijacker hiding itself using rootkit technology. Possibly distributed through some local news site that got hijacked or similar.
    – Mario
    Nov 25 '14 at 8:37
  • @Mario the problem is going wider. now, a lot of more people have this problem all over our country and as I know, in other countries to. Is it possible that the problem is with the modems? I mean, the problem is not from our system, DNS and the servers so I think this is from modems firmware which changed for most of users at a specific time! or something similar. Nov 25 '14 at 21:08

Not the answer you're looking for? Browse other questions tagged or ask your own question.